ClientLogin in the Google Data Protocol Client Libraries

Warning: This page is about Google's older APIs, the Google Data APIs; it's relevant only to the APIs that are listed in the Google Data APIs directory, many of which have been replaced with newer APIs. For information about a specific new API, see the new API's documentation. For information about authorizing requests with a newer API, see Google Accounts Authentication and Authorization.

Important: Do not use ClientLogin for new applications. Instead, use the more secure OAuth authentication protocol. ClientLogin is a deprecated authentication protocol and is being turned down on April 20, 2015. At that time, ClientLogin requests will no longer be answered. If you have existing applications that use ClientLogin, we encourage you to migrate to OAuth. The ClientLogin support in this library will be removed in the next major release.

Installed applications that need to access to a user's private data (protected by a Google or Google Apps (hosted) account), can use ClientLogin as programmatic
means for authenticating users. An "installed application" is one that is installed on a device, such as a desktop computer or a cell phone,
as opposed to a web application.

The Google Data API client libraries provide methods to help you use ClientLogin in your applications. Specifically, there are methods for
acquiring an authentication token, handling CAPTCHA challenges, recalling the auth token for later use, and sending the correct Authorization header with
every request.

Using ClientLogin and Google Data APIs without the client libraries

The client libraries are by no means the only way to use ClientLogin in your applications. Everything you need to know can be found
in the ClientLogin documentation, Authentication for Installed Applications.
However, the client libraries provide helpful methods for utilizing ClientLogin in your Google Data application.

Working with ClientLogin and the Google Data APIs: client library examples

This section gives examples of using the Google Data APIs client libraries to follow the steps outlined in the
"The ClientLogin Interface" section of the ClientLogin documentation.

The examples throughout this document demonstrate interacting with Google Calendar (although you don't need to know anything about the Calendar Data API to follow the examples).

Obtaining an auth token

To use ClientLogin, your application should make an HTTPS POST to the handler ClientLogin's handler
https://www.google.com/accounts/ClientLogin. The POST body should be structured
as a form post with the default encoding application/x-www-form-urlencoded. Using one of client libraries, you
can make this request in a single line of code.

The following samples first setup a service object connecting to the Calendar Data API, and then make an HTTP POST
to the ClientLogin handler.

See the request parameters section for a
detailed explanation of each ClientLogin parameter. A complete list of available service names is available in the FAQ.

Note: By default, the client libraries set an account-type parameter to
HOSTED_OR_GOOGLE. That means ClientLogin will first try to authenticate the user's credentials as a Google Apps hosted account. If that fails,
it will try to authenticate as a Google Account. This becomes tricky if user@example.com is both a Google Account and a Google Apps account.
In that special case, set the account type to GOOGLE if the user wishes to use the Google Accounts version of user@example.com.

Once the login information has been successfully authenticated, Google returns a token, which your application will reference each time
it requests access to the user's account, such as to GET or POST data. The token remains valid for a set length of time,
defined by whichever Google service you're working with. Typically, tokens remain valid for 2 weeks.

Recalling an auth token

After your application has authenticated the user once, there's no need for them to input their credentials again.
We recommend storing the Auth token in your database and recalling it as necessary. That will save the overhead of an additional
HTTPS POST and a possible CAPTCHA challenge.

Handling CAPTCHA challenges

A failure response from ClientLogin contains an error code and a URL to an error page that can be displayed to the user. If the error code is a CAPTCHA challenge,
the response also includes a URL to a CAPTCHA image and a special token. Your application should be able to solicit an answer from the user and
then retry the login request.